Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Mtls verify annotation support in native ingress controller #57

Open
wants to merge 7 commits into
base: main
Choose a base branch
from
Open

Mtls verify annotation support in native ingress controller #57

Changes from 1 commit
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
b774eab
mtls feature for OKE native ingress controller
georgexiang Apr 19, 2024
9886330
update mtls verify feature
georgexiang Apr 22, 2024
034497d
add test mtls verify method
georgexiang Apr 24, 2024
d3e222e
reversion Makefile to original version
georgexiang Apr 24, 2024
1a2d3d0
Add trustCACert part in oci-native-ingress.oraclecloud.com/mutual-tls…
georgexiang May 14, 2024
799aece
add verify trustcacert is a ca bundle
georgexiang Jun 4, 2024
f8485f3
Merge branch 'main' into mTLS-support
georgexiang Jul 9, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Add trustCACert part in oci-native-ingress.oraclecloud.com/mutual-tls… 
…-authentication

Signed-off-by: george <xiangzhihua@gmail.com>
  • Loading branch information
@georgexiang
georgexiang committed May 14, 2024
commit 1a2d3d04f66fb63d0077624977e8a91bfe79b66f
46 changes: 30 additions & 16 deletions pkg/controllers/ingress/ingress.go
View file
Original file line number Diff line number Diff line change
@@ -375,7 +375,7 @@ func (c *Controller) ensureIngress(ingress *networkingv1.Ingress, ingressClass *

// listenerSslConfig.VerifyPeerCertificate

mode, deepth := stateStore.GetMutualTlsPortConfigForListener(port)
mode, deepth, trustcacert := stateStore.GetMutualTlsPortConfigForListener(port)
mtlsPorts := stateStore.IngressGroupState.MtlsPorts
klog.Infof(" GetMutualTlsPortConfigForListener ********** mtlsPorts : %s ", util.PrettyPrint(mtlsPorts))

@@ -384,16 +384,23 @@ func (c *Controller) ensureIngress(ingress *networkingv1.Ingress, ingressClass *
// listenerSslConfig.VerifyDepth
listenerSslConfig.VerifyPeerCertificate = common.Bool(true)
listenerSslConfig.VerifyDepth = &deepth
caBundleId, _ := CreateOrGetCaBundleForBackendSet(ingress.Namespace, artifact, c.defaultCompartmentId, c.client)
if err != nil {
klog.Infof(" CreateOrGetCaBundleForBackendSet ********** CreateOrGetCaBundleForBackendSet port : %s ", port)
return err
}
if caBundleId != nil {
caBundleIds := []string{*caBundleId}

// check wethear the trustcacert is valid ca bundle
if isTrustAuthorityCaBundle(trustcacert) {
caBundleIds := []string{trustcacert}
listenerSslConfig.TrustedCertificateAuthorityIds = caBundleIds
}

// caBundleId, _ := CreateOrGetCaBundleForBackendSet(ingress.Namespace, artifact, c.defaultCompartmentId, c.client)
// if err != nil {
// klog.Infof(" CreateOrGetCaBundleForBackendSet ********** CreateOrGetCaBundleForBackendSet port : %s ", port)
// return err
// }
// if caBundleId != nil {
// caBundleIds := []string{*caBundleId}
// listenerSslConfig.TrustedCertificateAuthorityIds = caBundleIds
// }

}
klog.Infof(" GetMutualTlsPortConfigForListener after : %s ", util.PrettyPrint(listenerSslConfig))

@@ -522,7 +529,7 @@ func syncListener(namespace string, stateStore *state.StateStore, lbId *string,
}

var port = int32(*listener.Port)
mode, deepth := stateStore.GetMutualTlsPortConfigForListener(port)
mode, deepth, trustcacert := stateStore.GetMutualTlsPortConfigForListener(port)
mtlsPorts := stateStore.IngressGroupState.MtlsPorts
klog.Infof(" syncListenerr mtlsPorts : %s ", util.PrettyPrint(mtlsPorts))

@@ -538,16 +545,23 @@ func syncListener(namespace string, stateStore *state.StateStore, lbId *string,
if mode == util.MutualTlsAuthenticationVerify {
listener.SslConfiguration.VerifyPeerCertificate = common.Bool(true)
listener.SslConfiguration.VerifyDepth = &deepth
caBundleId, _ := CreateOrGetCaBundleForBackendSet(namespace, artifact, c.defaultCompartmentId, c.client)
if err != nil {
klog.Infof(" syncListener CreateOrGetCaBundleForBackendSet port : %s ", port)
return err
}
if caBundleId != nil {
caBundleIds := []string{*caBundleId}

// check wethear the trustcacert is valid ca bundle
if isTrustAuthorityCaBundle(trustcacert) {
caBundleIds := []string{trustcacert}
listener.SslConfiguration.TrustedCertificateAuthorityIds = caBundleIds
}

// caBundleId, _ := CreateOrGetCaBundleForBackendSet(namespace, artifact, c.defaultCompartmentId, c.client)
// if err != nil {
// klog.Infof(" syncListener CreateOrGetCaBundleForBackendSet port : %s ", port)
// return err
// }
// if caBundleId != nil {
// caBundleIds := []string{*caBundleId}
// listener.SslConfiguration.TrustedCertificateAuthorityIds = caBundleIds
// }

} else {
listener.SslConfiguration.VerifyPeerCertificate = common.Bool(false)
listener.SslConfiguration.VerifyDepth = common.Int(1)
13 changes: 7 additions & 6 deletions pkg/state/ingressstate.go
View file
Original file line number Diff line number Diff line change
@@ -42,9 +42,10 @@ type TlsConfig struct {
Type string
}
type MutualTlsPortConfig struct {
Port int32 `json:"port"`
Mode string `json:"mode"`
Depth int `json:"depth,omitempty"`
Port int32 `json:"port"`
Mode string `json:"mode"`
Depth int `json:"depth,omitempty"`
TrustCACert string `json:"trustcacert"`
}
type StateStore struct {
IngressClassLister networkinglisters.IngressClassLister
@@ -335,12 +336,12 @@ func (s *StateStore) GetTLSConfigForListener(port int32) (string, string) {
// return MutualTlsPortConfig{}
// }

func (s *StateStore) GetMutualTlsPortConfigForListener(port int32) (string, int) {
func (s *StateStore) GetMutualTlsPortConfigForListener(port int32) (string, int, string) {
portMtlsConfig, ok := s.IngressGroupState.MtlsPorts[port]
if ok {
return portMtlsConfig.Mode, portMtlsConfig.Depth
return portMtlsConfig.Mode, portMtlsConfig.Depth, portMtlsConfig.TrustCACert
}
return "", 0
return "", 0, ""
}

func (s *StateStore) GetTLSConfigForBackendSet(bsName string) (string, string) {
2 changes: 1 addition & 1 deletion pkg/state/ingressstate_test.go
View file
Original file line number Diff line number Diff line change
@@ -466,7 +466,7 @@ func TestMtlsAuthVerifyPortConfig(t *testing.T) {
err := stateStore.BuildState(&ingressClassList.Items[0])
Expect(err).NotTo(HaveOccurred())

mode, deepth := stateStore.GetMutualTlsPortConfigForListener(943)
mode, deepth, _ := stateStore.GetMutualTlsPortConfigForListener(943)

Expect(mode).Should(Equal(util.MutualTlsAuthenticationVerify))
Expect(deepth).Should(Equal(1))
2 changes: 1 addition & 1 deletion pkg/state/validate-mutual-tls-authentication.yaml
View file
Original file line number Diff line number Diff line change
@@ -10,7 +10,7 @@ metadata:
name: ingress-mutual-authentication-annotation-one
namespace: default
annotations:
oci-native-ingress.oraclecloud.com/mutual-tls-authentication: '[{"port": 80, "mode": "passthrough"}, {"port": 943, "mode": "verify","depth":1 }]'
oci-native-ingress.oraclecloud.com/mutual-tls-authentication: '[{"port": 80, "mode": "passthrough"}, {"port": 943, "mode": "verify","depth":1 ,"trustCACert" : "ocid1.cabundle.oc1.phx.amaaaaaacuco5yqaiwnnqo54ffsumwoxjxtgwtvyyau3dv7gyeisykfavzta" }]'
spec:
rules:
- http: